Their Own Little War: Iran Adopts Disruptive Ransomware
summary
Since 2020 four Iran‑nexus adversaries pivot from extortion to disruption, using commodity and bespoke tooling to lock and leak victim networks rather than collect crypto. Observed tools include a Thanos variant, Pay2Key then NetWorm, an Apostle/BlackShadow persona for media shaming, and custom wipers, BitLocker and descriptor routines. Campaigns target Israel, the Middle East and North America, blend data theft with public leak sites and press outreach, persist through 2021, and prioritize cover, harassment, degradation and influence over monetization.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:19Lock and Leak Model
- 1:26Primary Actors
- 2:26Spectral Kitten
- 3:49Lock Leak Timeline
- 4:58Why Iran
- 5:30Ransomware Motives
- 7:29Psychological Impacts
- 10:44Outro
related talks
52mIran's Soft-War for Internet Dominance
20mYour Persistent Friend: The Untold History of Iran’s Effectiveness in Using...
40mRansomware Threat Landscape
48mRansomware: From the Boardroom to the Situation Room
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
59mInnovation lessons we can learn from hackers
37mRansomware Resilience: Holistic Defense for SOC Leaders
10mBehind the Next Destructive Attack